G DATA researchers have uncovered a new malware specialized in data theft. Dubbed Chihuahua, the virus "combines common malware techniques with unusually advanced features." It is programmed to steal information stored on browsers and extensions linked to crypto wallets. Chihuahua is part of the category of infostealers, malware designed to suck up personal data from an infected system.
A booby-trapped Google Drive file
An attack using Chihuahua begins by sending a document stored on Google Drive. This malicious file contains a script that will activate a complex "multi-step" execution chain. Throughout the process, Chihuahua will bypass the computer's "execution policy controls" to remain undetected.
The virus succeeds by using the Base64 encoding method and "hexadecimal string obfuscation". This strategy allows it to hide code by transforming it into hexadecimal values, which helps to obfuscate security mechanisms.
Password Stealing and Cryptocurrency Plundering
Slowly, the virus begins searching for important or confidential files stored by web browsers and crypto wallet extensions. Targeted data includes saved passwords, cookies, browsing history, crypto wallet private keys, and session data. Payment information can also be stolen.
Once the data is collected, the virus will list everything in "a plain text file", which will then be compressed into a .zip archive with the extension ".chihuahua." The archive is quickly exfiltrated and recovered by cybercriminals. By "completing their task, the thief erases all evidence of their activity", explains G DATA.
With this information, it is possible to carry out a multitude of cyberattacks. It is also possible to steal all the cryptocurrencies stored in a wallet. In short, contrary to what its name suggests, Chihuahua is capable of serious damage. The virus primarily targets cryptocurrency holders.To avoid unpleasant surprises, we recommend that you exercise caution with Google Drive files exchanged by unknown parties. Be careful, it is not inconceivable that Chihuahua could spread quickly through other strategies.
Source: G Data
0 Comments